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ABSTRACT 


The concepts of vulnerability assessment and reduction have long been employed 
in the design of military aircraft. Aircraft design has many similarities to the design of 
small surface craft. Both disciplines deal with minimal recoverability and limited space, 
space that is crucial for critical component redundancy, separation, and many other 
principles of vulnerability reduction. This report attempts to directly apply established 
aircraft vulnerability assessment and reduction techniques to small surface craft, in 
particular, the Cyclone -class Patrol Coastal craft. 
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I. INTRODUCTION 


A. BACKGROUND 

Survivability has always been an important characteristic of U.S. Navy ships. In 
the earliest days of the nation, American sailing frigates were built with unusually sturdy 
hulls to resist the round-shot of the day’s weapons - USS Constitution, “Old Ironsides”, 
received her nickname for good reason. 

During World War II, U.S. Navy ships were subjected to numerous attacks with a 
wide range of weapons, from gunfire to torpedoes to suicide aircraft. Their success in 
surviving these threats was varied, but in many cases the ability of the ships to withstand 
major attacks was quite remarkable. The USS Franklin (CV13) was brought home by her 
crew after suffering unprecedented levels of damage. The USS Laffey (DD724), 
displacing only 3200 tons, sustained hits from four bombs and 5 bomb-laden kamikaze 
planes, while shooting down nine of them. The highly effective survivability design 
features of these ships combined with the incredible bravery and tenacity of their crews 
surely saved them. Clearly, survivability features have been designed into U.S. Navy 
ships for a long time. [Ref. 1] 

Some well-tested and well-understood principles for the survivability design of 
ships have long been employed. The fundamental principles include: 

1. Provide redundant installations of vital capabilities (so that the loss of one 
will not result in complete loss of an important capability). 

2. Locate vital installations in sheltered parts of the ship and provide them 
additional protection. 

3. Separate the redundant installations by as much distance as possible (ships 
with two missile launchers or gun mounts typically have one forward and 
one aft). 

4. Group all of the components necessary for the operation of a single 
installation close together so that one of the redundant capabilities can be 
lost, essentially, only by hitting it - it does not depend on the operation of 
widely-spread supporting components. 

Designing for survivability has, however, changed since the World War II era. 
The threats our ships must defeat are increasingly lethal; they carry larger warheads, 
operate at greater distances and employ increasing degrees of “smart” operation. 
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Reaction times are greatly compressed. Our ships, themselves, have evolved, causing our 
survivability-design approaches to evolve as well. Ships now carry large volumes of 
relatively light military payloads, rather than smaller volumes of more dense payloads; 
missiles instead of gun ammunition. The resulting large volumes make it impracticable, 
in most cases, to fully employ armor. 

The four principles referred to earlier remain appropriate and desirable, however, 
their implementation tends to rely on the fact that a ship provides fairly large amounts of 
volume and area. This provides the room needed to install redundant systems in the first 
place, as well as the size needed to permit their separation. 

B. CHANGING ENVIRONMENTS 

In the Cold War Era, when nuclear weapons were seen as the major threat to the 
U.S. Navy, the applicability of these time-tested survivability principles was not 
considered a priority. With a nuclear threat, it was assumed that a ship could not survive 
a hit, thus, much of survivability design as applied to surface combatants became 
irrelevant. Today, however, the threat of nuclear weapons is, while still very real, not the 
most pressing threat. The Navy has shifted its focus toward the littoral areas of the world 
and potential low intensity conflicts. The more apparent threats are non-nuclear, and are 
posed by terrorist groups and smaller navies. Non-nuclear threats are threats that a 
surface combatant can potentially survive, if the ship has adequate survivability for the 
given posed threat. 

The increasing emphasis on the littorals, however, has additional effects. The 
littorals are inherently dangerous, crowded places. In the littorals, there is an increased 
likelihood that an adversary can fire weapons from hidden land sites and the possibility 
exists that any of numerous small vessels can conceal threats. Furthermore, the reaction 
time one has in littorals is generally much shorter than in open ocean operations. In this 
kind of environment, employment of high-value, large Fleet units, before an adversary’s 
threat capabilities have been reduced, might be unacceptably risky. The result is an 
increasing interest in the employment of smaller ships and even vessels of the kind 
typically referred to as “small craft”. However, as discussed above, much of the U.S. 
Navy’s experience with ship survivability has employed principles which, in turn, are 
dependent to varying degrees on the large size of ships for their success - i.e. separation 
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of redundant installations. This gives rise to the question, how would survivability 
design for small craft differ from that for ships? Exploring this question if the central 
reason for this thesis. 

C. THE FUNDAMENTALS OF AIRCRAFT COMBAT SURVIVABILITY 

ANALYSIS AND DESIGN, BY ROBERT E. BALL 

In recent years, a well-developed body of survivability design principles has been 
created for aircraft. The Fundamentals of Aircraft Combat Survivability Analysis and 
Design, by Robert E. Ball [Ref. 2], is a comprehensive treatment the fundamentals of 
survivability engineering and their application to aircraft design. Published by the 
American Institute of Aeronautics and Astronautics, this text provides the principles of 
survivability that are accepted and used by the aircraft industry at large. This text offers 
the basic taxonomy of the aircraft combat survivability discipline, which is being 
successfully applied to ships. But as interest in smaller ships or small craft increases, and 
some of the traditional ship survivability design principles become less applicable, it 
seems sensible to explore the degree to which techniques of survivability design and 
assessment arising in the aircraft domain are applicable to small craft. With smaller ships 
and craft, there begins to exist an increasing convergence on “aircraft-like” 
characteristics. Small craft begin to resemble aircraft in size as they move away from the 
larger size of ships; the use of aluminum and composites for weight reduction is more 
ubiquitous in small craft, as in airplanes; and the volumes and areas available in ships are 
not available in small craft. 

In this thesis, then, the applicability of Ball’s aircraft combat survivability 
methods to small surface craft will be explored. Because the entire content of this thesis 
is based on the methods laid out in Ball’s text, repeated citation of The Fundamentals of 
Aircraft Combat Survivability Analysis and Design will not included while using these 
specific methods. It should simply be noted that all of the methodology in this thesis 
comes from Ball’s text. 

D. SURVIVABILITY PRINCIPLES 

Surface ship combat survivability is defined as “the capability of a surface ship to 
avoid and/or withstand a manmade hostile environment while performing its 
mission”[Ref. 1]. It has two main components: susceptibility and vulnerability. 
Susceptibility is defined as “the probability a ship is hit by a damage-causing 
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mechanism” [Ref. 1]. There are three probabilistic quantities that make up susceptibility. 
The first is the probability that the threat is active and ready to engage. The second is the 
probability that the surface ship is detected, identified, and tracked by the threat. The 
third is the probability that the threat has a successful launch, flight, and impact with the 
ship. Ship design, tactics, survivability equipment, and onboard weapons systems 
influence the susceptibility of a given surface ship. Although susceptibility is a critical 
component of survivability calculations, this thesis will not focus on it. For all discussion 
and calculations, it will be assumed that the ship is hit. The focus, then, is on the 
probability that a ship will be killed given that the ship has been hit. This is known as 
vulnerability. [Ref. 1] 

The second component of ship survivability is vulnerability. Vulnerability is 
defined as “the inability of a ship to withstand the damage caused by the hostile 
environment” [Ref. 1], In other words, it is the conditional probability of being killed, 
given a hit. Vulnerability is primarily determined by the design of the ship, and can be 
significantly minimized in the design process. 

Recoverability, the probability that a ship can recover from damage, is another 
important component of surface ship survivability. In general, surface ships tend to have 
significant damage control abilities, and can often recover from a potential kill [Ref. 3]. 
However, aircraft, as well as small craft, either do not have these capabilities or possess 
them to a greatly reduced degree. The focus of this study is the applicability of aircraft 
survivability design methods to small surface craft. Therefore, in this study, it will be 
assumed that the small craft has no recoverability. 

These probabilistic quantities can be combined mathematically. Survivability 
( P s ) of a craft is calculated using 

p s =\-[p h *p kih *(1-p r )\, 

where P H is the ship’s susceptibility, P K/H is the ship’s vulnerability, and P R is the 
probability that the ship will recover [Ref. 3]. Since, as previously stated, one 
assumption behind this study is that the craft in question has no recoverability, P R is set 
to zero. This leaves the following equation for the calculation of survivability 
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P S =\-{P H *P KIH ). 


This equation comes from the relationships between killability, susceptibility, and 
vulnerability. Killability is the probability that the ship will be killed. The killability of 
the ship is calculated using 

p = p * p 

1 K 1 H 1 K/H 

which is simply the product of susceptibility and the vulnerability. The survivability of 
the ship can be thought of as the opposite of killability, that is, killability plus 
survivability equals one. Therefore, 

Ps^-Pk- 

Due to the nature of ships, a kill does not always imply total destruction and sinking of 
the ship. There are many levels of kill, each with its own degree of severity. The degrees 
of kill will be discussed at length in the following chapter. [Ref. 1] 
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II. VULNERABILITY ASSESSMENT 


A. WHAT IS A VULNERABILITY ASSESSMENT? 

A vulnerability assessment is a means of obtaining quantitative values for the 
measures of vulnerability of the craft under review. Such an assessment can be carried 
out manually or with the help of a computer vulnerability analysis program. In any case, 
the vulnerability assessment allows for the comparison of craft based solely on 
vulnerability. 

Ball’s method of aircraft vulnerability assessment calls for the assessment to be 
completed at one of three levels of detail: estimate, evaluation, or analysis. Estimates use 
only a few major parameters of the craft and only focus on the major damage 
mechanisms. They use simple equations and the output is a very rough estimate of the 
vulnerability of the craft. Evaluations are more detailed assessments, using specifics 
from the aircraft such as critical component sizes and locations, as well as specific 
damage mechanisms. The output is harder to achieve than that of an estimate, but it can 
be much more accurate. Analyses are vulnerability assessments carried out to the utmost 
level of detail. They are usually conducted using complex models of the craft under 
review. Analyses are, of course, the most accurate vulnerability assessments. 

Vulnerability assessments, whether they are carried out by hand or by computer, 
are accomplished using various vulnerability assessment techniques. Not only are there 
several types of vulnerability assessment techniques, there are also several different 
measures of vulnerability that can be calculated for a craft in a hostile environment. 
Nevertheless, there are general requirements for all assessment techniques and 
vulnerability measures. 

B. VULNERABILITY MEASURES 

The vulnerability of a craft depends largely on its environment and the type of 
threat it is likely to encounter in that environment. This holds true both for aircraft and 
small craft alike. For example, the vulnerability measure P K/H represents the probability 

of a kill given a hit. The use of this vulnerability measure would be appropriate when the 
craft is in a hostile environment in which the threat needs to hit the craft in order to kill it. 
Another vulnerability measure is the craft’s vulnerable area, A v ■ This is an area, the 
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calculation of which will be discussed later, that, if hit, would result in a kill. These are 
just two examples of a variety of vulnerability measures that can be calculated using 
vulnerability assessment techniques. 

C. GENERAL REQUIREMENTS 

Regardless of the type of vulnerability measure or the specific technique used, all 
techniques have certain general requirements that make them viable options for a 
vulnerability assessment. Ball’s method indicates the following requirements for an 
aircraft vulnerability assessment. These general requirements are true for aircraft as well 
as small craft vulnerability assessments; however, the specifics of the elements will 
differ. The required elements are: (1) kill level selection, (2) technical and functional 
description of the craft, (3) critical component determination, (4) threat selection, (5) 
critical component kill criteria, and (6) computation of vulnerability measures. 

1. Kill Level Selection 

In small craft, as in aircraft, all kills are not equal with respect to vulnerability. 
Ball uses three kill levels to measure the degree to which an aircraft suffers performance 
degradation in aircraft vulnerability assessments. These levels are Attrition Kill, Mission 
Abort Kill, and Forced Landing Kill. There are similar kill levels commonly used when 
discussing ship survivability. The following kill level definitions are commonly used 
when discussing ship survivability and they will be used for the entirety of this research 
effort: 

• Total Kill will refer to the ship being totally lost and abandonment 
occurring. This would most likely be caused by sinking or catastrophic 
fire. 

• A Mobility Kill will refer to loss of mobility and/or loss of controllability. 

• A Mission Area Kill will refer to loss the ability to perfonn a specific ship 
mission (i.e. SEAL insertion/extraction capabilities). 

• A System Kill will refer to any damage that leads to the loss of an entire 
ship system (i.e. Lighting system). [Ref 1] 

Of course, these kill levels are dynamic in nature. For example, with time and 
poor recoverability and/or damage control efforts, an initial system kill can turn into a 
mission area kill, which can eventually turn into a mobility kill which can lead to a 
potential total kill. [Ref 1] 
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2. Technical and Functional Description of the Craft 

Just as Ball’s method indicates, as much information as possible about the craft 
should be gathered prior to commencement of the vulnerability assessment. The amount 
of information needed depends on the level of detail to which the assessment is to be 
completed. In general, this includes technical and functional descriptions. The technical 
description should include all major systems. Infonnation regarding location, size, 
material, construction, and operation of systems, subsystems, and components is essential 
for an accurate assessment. The functional description should describe the functions 
provided by the systems, subsystems, and components, as well as define functional 
relationships between them, including redundancies. 

This general requirement is much harder to meet for small craft than it is for 
aircraft. While the major systems in both are similar, there are far more subsystems and 
many more components in a small craft. 

In the example of the Patrol Coastal Cyclone Class, many of the technical and 
functional descriptions were identified, using the PC-1 Class Booklet of General 
Drawings. This proves that with enough time, it is possible to obtain complete technical 
and functional descriptions of a small craft. 

3. Critical Component Determination 

Ball defines a critical component as any component, which, if either damaged or 
destroyed, would yield a defined or definable kill level. The criticality of a given 
component is closely tied to functionality. If a component provides an essential function 
it can be deemed a critical component. If a component does not provide an essential 
function, yet its failure leads to the failure of a critical component that does provide an 
essential function, then it too can be deemed a critical component. As indicated by Ball’s 
method, the following steps should be taken to identify the critical components of an 
aircraft: (a) identify flight and mission essential functions, (b) identify system essential 
functions relationships, (c) conduct a failure modes and effects analysis (FMEA), (d) 
conduct a damage mode and effects analysis (DMEA), (e) conduct a fault tree analysis 
(FT A), and (f) complete a kill tree and/or a kill expression. 
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a. Flight and Mission Essential Functions 

Ball’s method identifies flight and mission essential functions first in the 
pursuit of critical components. For a small craft, flight is comparable to stability and 
mobility. Therefore, the first step in critical component determination for a small craft is 
identification of stability, mobility, and mission essential functions. Stability essential 
functions are those system and subsystem functions that allow the small craft to float 
upright. An example of this is the provision of watertight integrity of the hull by the 
structural system. Mobility essential functions are those system and subsystem functions 
that enable the small craft to sustain controlled motion. An example of a mobility 
essential function is the provision of thrust by the propulsion system. Mission essential 
functions are those system and subsystem functions that enable the small craft to perform 
its designated missions. For the Cyclone -class patrol craft, an example of a mission 
essential function is the ability to launch the rigid hull inflatable boat (RIB) so that it may 
board intercepted traffic. This function is provided by the small boat subsystem. 

Table 1 and Figure 1 provide useful information for this step in the 
vulnerability assessment. Table 1 lists some of the essential functions for the Cyclone- 
class patrol craft. Figure 1 is a chart that can be used to determine which functions are 
essential for which mission/mission phases. This figure is especially useful for the 
determination of the most essential functions of the craft. 

b. System Essential Functions Relationships 

The next step in the detennination of critical components is to examine the 
essential system-function relationships. From the previous step, the most essential 
functions were identified. With this information in hand, a check should be made to 
detennine which systems and subsystems contribute to these essential functions. Figure 
2 is a chart that is useful for determining the systems that are necessary for the essential 
functions of the Cyclone -class patrol craft to continue. 

c. Failure Mode and Effects Analysis (FMEA) 

Ball offers the failure mode and effects analysis is a means of identifying 
all the failure modes of subsystems, and components, as well as detennining the effects 
of these failures on the subsystems and systems of the craft. Table 2 shows sample 
FMEAs for a number of different components and kill levels. 
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Table 1. Some Essential Functions of the Cyclone -Class 


FLOTATION/MOBILITY 

MISSION 

SUPPORT SERVICES 

Provide flotation 

Provide communications 

Provide electric power 

Provide thrust 

Provide internal comms 

Provide air conditioning 

Control mobility 

Provide external data links 

Provide mess services 

Provide speed-making ability 

Start systems 

Provide head services 


Monitor systems 



Gather Intelligence 



Operate sensors 



Navigate 



Locate/ID targets 



Employ weapons 



Deploy RIB 
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MISSION PHASES 



Figure 1. Essential Functions and Mission Phases of the Cyclone -Class 
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Figure 2. Essential System-Function Relationships for the Cyclone -Class 
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Table 2. Example FMEA for Cyclone -Class 


Generic Failure Modes of a Subsystem 

1 

Premature operation 

2 

Failure to operate 

3 

Failure to cease operation 

4 

Out-of-tolerance operation 


Component 

Location 

Failure Mode 

Effect on 
Subsystem 

Ship 

System 

Effect of Degraded 
Subsystem on Ship 

Kill Level 

Reduction 

Gears 

3-14-0-E 

and 

3-29-0-E 

2. Loss of 
lubrication 

Total loss of 

reduction 

capabilities 

Propulsion 

Ship loses mobility 

Mobility 

Kill 

Port Rudder 

Stem 

4. Structural 
damage from 
foreign object 

Total loss of 

rudder 

capabilities 

Auxiliary 

(Steering) 

Ship maintains ability to 
maneuver with the 3 
rudders, but it requires 
much greater effort on 
part of crew and puts 
strain on the other 
rudders 

Component 
Kill that 
will 

eventually 
lead to 
System 

Kill 

SEALS 

3-49-0-E 

2. Loss of 
crew in SEAL 
prep room 

Total loss of 

SEAL 

capabilities 

Crew, 

possibly 

Structural 

Ship cannot perform it's 
SPECWAR OPS 
mission 

Mission 

Area Kill 


d. Damage Mode and Effects Analysis 

The damage mode and effects analysis is a means of identifying the 
damage-caused failure modes of the craft. The DMEA can take many forms, such as a 
DMEA matrix, a disablement diagram, or simply a list of damage-caused failure modes. 
Regardless of the form, the DMEA should identify the different kinds of damage-caused 
failure modes that can occur within each system of the small craft. Table 3 offers a list of 
system damage-caused failure modes for the Cyclone-class patrol craft. 

e. Fault Tree Analysis (FTA) 

A fault tree analysis is a means of determining what event or combination 
of events will result in a specific undesired event. This approach starts with a specific 
undesired event and, through a series of logic gates, detennines all the possible events 
and combinations of events that will result in the initial undesired event. 
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Table 3. A List of the Damage-Caused Failure Modes for the Cyclone -Class [After Ref. 4] 


TOTAL KILL 

MOBILITY KILL 

MISSION KILL 

Structural Svstem 

Electrical Power 

Crew 

Structural removal 

Severing or grounding 

Loss of crew (death or injury) 

Pressure overload 

Mechanical failure 


Thermal weakening 

Overheating 

Auxiliary Eauinment 

Penetration 


Loss of small boat system 

Fire/flooding 

Electronic Eauinment 


WT bulkhead damage 

Loss of control power 

Electronic Eauinment 


Loss of antennas, etc. 

Loss of control power 

Combat Svstem 


Loss of antennas, etc. 

Fire 

Auxiliary Eauinment 


Explosion 

Loss of monitoring systems 

Combat Svstem 


Loss of piping system 

Fire 


Fuel supply depletion 

Explosion 


In-tank fire/explosion 

Loss of weapon capabilities 


Void space fire/explosion 

Depletion of armament 


Sustained exterior fire 



Damage to rudder 






Pronulsion Svstem 



Foreign object ingestion 



Inlet flow distortion 



Lubrication oil depletion 



Exhaust duct failure 



Engine control and 
accessories failure 



Failure of shaft, gearbox, 
bearings, etc. 



f. Critical Components, Kill Trees and Kill Expressions 
The previous steps should provide enough infonnation to accurately 
determine the critical components of the craft. As stated before, a critical component is 
any component, which, if either damaged or destroyed, would yield a defined or 
definable kill level [Ref 1]. One final comparison that Ball never explicitly makes can be 
helpful in this determination. This comparison can be seen in Figure 3. This figure 
shows a breakdown of the ship systems into subsystems can components. It compares 
these subsystems and components to the mission phases. Furthermore, the degree to 
which a component or subsystem is critical to a mission phase can also be indicated. The 
degrees are: (3) Component is ABSOLUTELY NECESSARY for completion of this 
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mission phase, (2) Component is ALWAYS USED, BUT POTENTIALLY NOT 
NECCESSARY for completion of this mission phase, and (1) Component is HELPFUL 
for completion of this mission phase. Summation across the row for each component or 
subsystem provides a numerical means of comparing the criticality of components and 
subsystems. Obviously the Component/Subsystem column can be further broken-down 
into greater detail. 

Once the critical components have been identified, it is often useful to 
create a kill tree. A kill tree is a visual representation of the critical components. Kill 
trees are a convenient means of illustrating the redundancy or non-redundancy of critical 
components. Figure 4 shows a kill tree for the Cyclone -Class patrol craft. 

The kill expression is a logical statement that describes the kill tree in 
words. This statement will therefore indicate critical component redundancy. Figure 5 
shows a kill statement that corresponds to the kill tree in Figure 4. 

4. Threat Selection 

After detennining the critical components of the craft, a selection of the specific 
threats that it might encounter should be made. A vulnerability assessment is usually 
done considering either a specific threat or a specific damage mechanism. 

The specific threats that a small craft might encounter are not entirely the same as 
those encountered by an aircraft. In Ball’s method, threats have been grouped into 
general categories of damage mechanisms. These threat categories are: (a) a 
nonexplosive penetrating projectile or fragment, (b) the fragments and blast from 
internally detonating warheads, (c) external blast, (d) the fragments, penetrators, and 
missile debris from externally detonating warheads, and (e) the laser. A small craft may 
encounter all of these threats, so they should all be looked at in the examination of the 
Cyclone -class patrol craft. However, small craft should also consider the threat of 
nuclear weapons as well as chemical, biological, and radioactive weapons. Another 
aspect of threat selection that should be addressed is the air-water interface, which adds 
more complexity to the threat selection for a surface craft. The same threat can have very 
different effects on a surface ship depending on if it hits above, below, or at the waterline. 
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Figure 3. Critical Component Determination 
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Figure 4. Kill Tree 
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[(MPDE1 OR Shaft 1 .OR. Reduction Gear 1) .AND. (MPDE2 .OR. Shaft 2 .OR. 
Reduction Gear 2) .AND. (MPDE3 OR Shaft 3 .OR. Reduction Gear 3) .AND. (MPDE4 
.OR. Shaft 4 .OR. Reduction Gear 4)] .OR. [Diesel Generator 1 .AND. Diesel Generator 
2] .OR. Power Distribution System .OR. AC Lighting/Power System .OR. Fuel Pump 
.OR. [Fuel Oil Tank 1 .AND. Fuel Oil Tank 2 .AND. Fuel Oil Tank 3] .OR. Hydraulic 
Tank .OR. [(Steering Pump 1 .OR. Motor 1) .AND. (Steering Pump 2 .OR. Motor 2)] 
.OR. [Rudder 1 .AND. Rudder 2] .OR. Monitor & Control Systems for Auxiliaries .OR. 
Crew 

Figure 5. Kill Expression (Mobility Kill) 

For the example of the Cyclone -class patrol craft, all of the above threats are 
potential threats for which a vulnerability assessment could be made. To determine the 
most applicable threats, an examination of the missions and working environment must 
be made. The primary mission of most small craft is coastal patrol and interdiction 
(CP&I). In this mission, patrol craft regulate maritime shipping traffic; conduct 
inspections of shipping traffic; interdict drug runners, pirate, smugglers, and illegal 
immigrants [Ref 5]. The likely threats to be encountered during this mission are small 
anns carried by drug runners, pirates, smugglers, and illegal immigrants. Small arms fall 
into the category of nonexplosive penetrating projectiles or fragments. [Ref. 5] 

In continuation of the specific example of the Cyclone -class patrol craft, the 
current primary mission is homeland defense and port security. This mission involves 
many of the same duties as CP&I. Along with those duties, it also includes the 
interception of suspicious ships prior to port entrance, the provision of anti-terrorism 
protection for Navy ships, the escorting of commercial ships in and out of U.S. ports, and 
the deployment of U.S. Coast Guard law enforcement teams [Ref. 6]. The likely threats 
to be encountered in this mission include those listed above, as well as the potential threat 
of terrorists. The terrorist threats to be considered are small arms, bombs, suicide 
bombers, as well as unconventional weapons. This means that a comprehensive 
vulnerability assessment of the Cyclone -class patrol craft would include assessments of 
the ship’s vulnerability with respect to nonexplosive penetrators or fragments, internally 
detonating warheads, externally detonating warheads, and possibly nuclear, chemical, 
biological, radioactive and threats. 
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5. Critical Component Kill Criteria 

After determining the critical components and selecting the threat to be assessed, 
the damage criteria for each of the failure modes of the critical components must be 
evaluated with respect to the specific threat that has been selected. The goal of this step 
is to determine what criteria must be met for each critical component to be killed in each 
of its failure modes for each threat selected. Ball uses four specific kill criteria in 
assessing aircraft critical component kill criteria. They are (a) the P k/h function, (b) the 

area removal criterion, (c) the energy density criterion, and (d) the damage criteria for 
blast. 

a. The P k/h Function 

Determination of the probability of a component kill given a hit is one 
method of determining the criteria for a component kill. For this criterion, Ball defines a 
hit as impact by a fragment or penetrator. The P k/h function is usually used for single 

fragment vulnerable components; meaning those components that can be killed by a 
single hit. It is a function of the many things, including but not limited to, the mass and 
velocity of the fragment or penetrator. 

Ball’s method indicates that values for P klh are generally obtained through 

a separate engineering analysis done for each critical component. Each critical 
component is examined, and the effects of a hit by a specific threat are estimated. The 
mass, striking velocity, obliquity, and shape of a penetrator or fragment must also be 
accounted for. A numerical value for P kjh is then assigned to each component based 
somewhat on experimental data, but mostly on experience and engineering intuition. 

Location within the craft plays a part in estimating the P klh value for a 

given component. Since this criterion depends heavily on striking velocity and is 
influenced by obliquity of the penetrator or fragment, a component that is shielded by a 
number of other components will have a lower P k/h value than a component with no 

shielding. This plays a greater role in the assessment of small craft than for an aircraft 
since a small craft has more potential shields, because it has more components. This is 
good from a vulnerability reduction standpoint, since it offers designers many non-critical 
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components with which to shield a critical component. Vulnerability reduction will be 
discussed in depth in the next chapter. 

b. The Area Removal Criterion 

Ball’s second method for determining the criteria for a component kill is 
the area removal method. For each critical component, a particular amount of area is 
specified. This area represents the amount of area that, if removed by a hit from a 
penetrator, would result in a component kill. This method is applicable to any damage 
mechanism that is capable of removing a given amount of area. Usually, it is applied 
when the threat is a large penetrator or many small penetrators or fragments. In general, 
this method is used in aircraft for structural components. In small craft, this method 
could be extremely useful for watertight bulkheads or other critical components in the 
structural system whose performance might be severely degraded with significant area 
removal. 

c. The Energy Density Criterion 

Another type of critical component kill criterion that Ball offers is the 
energy density criterion. In this method, like the area removal criterion, a particular 
amount of area is specified for each critical component. In this method, however, that 
area represents the minimum surface area that must be exposed to a threshold level of the 
kinetic energy density of the impacting damage mechanism. Ball’s method prescribes the 
energy density criterion to any large aircraft components, such as structural components, 
fuel tanks, and propulsion components. In small craft, it could be applied to these same 
types of large components. 

d. The Damage Criteria for Blast 

The damage criteria for blast, as stipulated by Ball’s method for aircraft, 
are the critical values for pressure and impulse on the surface of an aircraft necessary to 
kill a given component. For surface ships, it is necessary to also consider shock, which is 
simply an underwater blast. For small craft, it is important to consider the critical values, 
or thresholds, of pressure and impulse for all critical components with respect to blast and 
shock [Ref 3]. This is one instance in which Ball’s aircraft method is not adequate for a 
small craft vulnerability assessment. 
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III. COMPUTATION OF THE VULNERABILITY MEASURES 


A. NONEXPLOSIVE PENETRATORS OR FRAGMENTS 

Nonexplosive penetrators or fragments are the first category of damage 
mechanisms to be evaluated. Ball’s method indicates that the vulnerability of a craft with 
respect to this threat selection is usually given as the total vulnerable area, A v , or as the 

probability of a craft kill given a random hit on the craft, P K/H . Both of these measures 
are also applicable to the individual critical components of the craft. The vulnerable area 
of the i"‘ critical component is denoted by A v . The probability of killing the i th critical 

component, given a hit on the i"‘ critical component is denoted by P klh . This is not to be 

confused with the probability of killing the i' h critical component given a random hit on 
the craft, which is denoted by P k/H . The process of determining the P KIH function was 

discussed earlier. The process of calculating the vulnerable area will now be addressed. 

1. Presented Area 

The first thing that needs to be detennined for these calculations to be made is the 
presented area of the craft or component in the plane nonnal to the approach of the 
damage mechanism. The presented area of the ship and the presented area of the 
i" critical component of the ship are denoted by A p and A p , respectively. For the 

example of the Cyclone -class patrol craft versus the threat of nonexplosive penetrators or 
fragments, one presented area is the ship profile above the waterline. Obviously there are 
other potential approaches a damage mechanism could take, this is merely an example of 
the most likely aspect that the mechanism will see. This particular presented area does 
not include the presented area of the hull that extends below the waterline. This is 
because a nonexplosive penetrator, like small arms, would be extremely unlikely to 
approach the craft below the surface of the water. [Ref. 4] 

For the Cyclone- class, the presented area of the ship is approximately 2820 ft“. 
The presented area of individual critical components would be calculated only for those 
components located above the waterline. For comparison purposes, the presented profile 
area of a large military aircraft, such as the P-3 Orion is approximately 700 ft . A sleeker 
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fighter aircraft, such as the F-14 Tomcat has a presented profile area of approximately 
2 • 

300 ft . Figure 6 shows how these approximations were made. 



F-14 Tomcat 






Figure 6. Approximation of Craft Presented Areas [After Ref. 7] 

2. Vulnerable Area 

The vulnerable area is a measure the degree of vulnerability of a craft or 
component. For a craft, the vulnerable area is given by the following equation 

a - A p 
Sly — Sip 1 K! H ■ 

It is the product of the presented area and the probability of a kill given a hit. The latter 
of these is very difficult to define for a craft. The probability of a craft kill given a 
random hit on the craft depends on many things. To come up with a useful measurement, 
the vulnerable area of individual critical components is often calculated. The summation 
of the vulnerable areas of all the critical components on a craft equals the vulnerable area 
of the craft itself. The vulnerable area of a critical component is equal to the product of 
that component’s presented area and the P k/h value for the component. Ball’s method 

uses the following equation to calculate the vulnerable area of the i th critical component 
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A V/ =A p P k/hi . 

Then, for N critical components, the equation for the vulnerable area of the entire craft is 
given by 

N 

i 

The P KIH value for the entire ship can then be estimated using the following equation 


For the example of the Cyclone -class patrol craft, one of the critical components 
that could be damaged by a nonexplosive penetrator or fragment (i.e. a component above 
the waterline) is the number one ship service diesel generator. There are actually two 
diesel generators on the Cyclone- class, which makes it a redundant component. 
Redundancy will be discussed in detail in a following section. For the following 
calculations redundancy will not be addressed. The presented area of the diesel generator 
from the profde view is approximately A = 33 ft 2 . For example purposes, the P k/h 

value for the diesel generator, with respect to the particular threat of a single 
nonexplosive penetrator, can be estimated to be P k/h =0.2. This means that, given 

that a nonexplosive penetrator of fragment hits the diesel generator, it has a 20% chance 
of being killed. The vulnerable area of the diesel generator, in this particular scenario is 
then calculated as follows 

A Vssdgi = (33/t 2 )x(0.2) = 6.6ft 2 . 

As another example, the following components of the Cyclone will be considered 
critical components as an example: four main propulsion diesel engines (MPDE), four 
main propulsion shafts (MPS), and two ship system diesel generators (SSDG). The Table 
4 shows the probabilistic data. The values for A were obtained from simple component 

geometry for the profile view of all components. These values for A represent the 

individual component presented areas. All four of the critical components listed in Table 
4 are redundant components. Furthermore, the main engines and the shafts overlap other 
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components. Since the concepts of overlap and redundancy have not yet been explored, 
the total presented area will simply be the summation of the individual presented areas of 
two main propulsion engines, one forward shaft, one aft shaft, and two diesel generators. 
This will sum to be the total area of critical components that is presented to a damage 
mechanism approaching from abreast. The values for the P k/h functions are sample 

values that should not be taken literally. For actual values, separate engineering analyses 
must be performed on each critical component. Furthermore, as previously stated, there 
are many factors that affect the P k/h function, none of which have been defined for this 

example. 


Table 4. Probabilistic Data for Cyclone -Class 


Critical Component 

4, * p k/hi = 4, 

(ft 2 ) (ft 2 ) 

P - v 

k/H > - /A p 

Main Propulsion Engine 

77.0 

0.1 

7.7 (x2) 

0.00546 

Fwd Main Propulsion Shaft 

20.7 

0.25 

5.2 (xl) 

0.00184 

Aft Main Propulsion Shaft 

11.1 

0.25 

2.8 (xl) 

0.00098 

Diesel Generator 

33.0 

0.2 

6.6 (x2) 

0.00468 

For the entire craft... 

A P =2820 


Ay =36.6 

P KIH = 0.01296 


3. Additional Probabilistic Vulnerability Measures 

The vulnerable area is one measure of vulnerability of a critical component. 
There are a few probabilistic values that are also important in both aircraft and small craft 
vulnerability assessments. 

a P 

1 h/H i 

Since it is not known where a nonexplosive penetrator or fragment will 
penetrate the craft, a useful value to calculate is the probability that a component is hit 
given a random hit on the craft. This value indicates the likelihood of a component hit. It 
is the ratio of the presented area of the component to the presented area of the craft. It is 
given by the following equation 
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For the example of the Cyclone -class patrol craft, this equation can be 
used directly. Continuing the example of the diesel generator, the probability of the 
diesel generator being hit, given that there is a random hit on the ship is calculated as 
follows 


h / H c. 


(33 ft 2 ) 
(2820 ft 2 ) 


= 0.01170. 


b’ Pk/H 

The probability of a component kill given a random hit on the craft is one 
of the more important values for vulnerability assessment. Ball offers the following 
equation to calculate this value 


k/H: 


p p 

1 h/Hk / hi 


This measure also lends itself directly to the assessment of small craft 
vulnerability. For the Cyclone -class small craft, the probability that the diesel generator 
will be killed, given a random hit on this ship for a nonredundant case is calculated as 
follows 


P klBmm = (0.0117)x (0.2) = 0.00234. 


The above equations can be further manipulated such that 


k IH: 


A p ’ 


This produces the same result for the probability that the diesel generator 
is killed given a random hit on the Cyclone -class patrol craft 


k/H., 


(6.6 ft 2 ) 
(2820 ft 2 ) 


0.00234. 


c. Probability of Survival 

The probability of killing a craft or one of its components plus the 
probability of survival of that craft or component is unity. From this relationship, Ball 
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gives the following equations. The first equation states the probability of the survival of 
the craft, given a random hit on the craft. The second equation states the probability of 
survival of the i ,h component of the craft, given a random hit on the craft: 

P = 1 — p 

1 SI H 1 1 K/H 

P = 1 - P 

1 s/H, 1 1 klHj • 

Again, these survivability equations can be directly applied to small craft. 
The survivability of the diesel generator given a random hit on the Cyclone -class patrol 
craft is calculated as follows 

P,„ = 1 — (0.00234) = 0.9977. 

* iri SSDG 1 

4. Single Hit Vulnerability 

Ball’s treatment of vulnerability versus nonexplosive penetrators or fragments is 
broken-down into two categories: single hit vulnerability and multiple hit vulnerability. 
Single hit vulnerability assumes only one penetrator. Both redundant and nonredundant 
models of craft are considered in this method. Furthennore, consideration is given to the 
overlap of redundant and nonredundant critical components. 

Ball addresses the following four models separately in his analysis of single hit 
vulnerability towards nonexplosive penetrators or fragments: nonredundant model with 
no component overlap, nonredundant model with component overlap, redundant model 
with no component overlap, and redundant model with component overlap. Most small 
craft have some degree of redundancy and overlap among critical components. For this 
reason, only the final of Ball’s categories will be examined in this vulnerability 
assessment. 

a. The Redundant Model 

Redundancy is a vulnerability reduction technique that will be discussed in 
length in the next chapter. In short, when a critical component is labeled as being 
redundant, identical or similar components duplicate some or all of its essential functions. 
A nonredundant critical component is the only component on the craft that performs a 
particular essential function. Nonredundancy can increase the degree of criticality of a 
critical component, since the loss of a nonredundant critical component means complete 

loss of a particular essential function of the ship, hence a kill on some level. 
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The kill expression for a redundant craft uses logical AND statements. It 
is given in the form 

Kill = ( Rc\).A ND.( Rc2).A ND. ■ ■ • .AND.(RcN) 

where Rc\ refers to the kill of redundant component 1 and there are N redundant 
components. In order for the craft to be killed, it must lose an essential function. In the 
case of strictly redundant critical components, an essential function is only lost when all 
the redundant components that can provide that function are killed. 

Another model includes both redundant and nonredundant critical 
components. The kill expression for this model uses logical AND and OR statements. It 
is given in the form 

Kill = (Nrc\).0R.(Nrc2).0R. ■ ■ ■ .0R.(NrcM).AND.(Rc\).AND.(Rc2).AND. ■ • • .AND.(RcN) 

where Nrcl refers to the kill of the nonredundant component 1, there are M 
nonredundant components, Rcl refers to the redundant component 1, and there are N 
redundant components. The probability of craft survival given a random hit on this 
model is given by Ball as either of the following equations 

M N 

/=1 y'=l 


or 

M N 

^=n<i-'w<i-rKA 

z=l 7=1 

It is also worth noting that for these models, since only a single penetrator 
is being considered, component kills are mutually exclusive. That is, once one 
component has been killed, no other components will be killed. 

The example small craft, the Cyclone- class patrol class, has both 
redundant and nonredundant critical components, so this model should be employed. 
However, it also has overlapping critical components, a topic that must be addressed 
before an assessment of the Cyclone can take place. 


29 



b. The Overlapping Model 

Creating overlap amongst critical components is a means of decreasing the 
total presented area of the components. Overlap depends on aspect, since some 
components may overlap from one aspect, but not another. For example, if one critical 
component is directly above another they overlap if a threat mechanism penetrates from 
directly above or below the craft, but they do not overlap if the penetrator comes from 
either side of the craft. This model assumes that any hit on the craft takes place along a 
shotline that passes completely through the craft, regardless of how many critical 
components are overlapped along that shotline. This means that, in this model, 
component kills are not mutually exclusive. This is not always the most appropriate 
model, since in some cases components will undoubtedly shield other components that 
they overlap, but Ball’s approach offers a conservative method. 

The layout of the craft, and the aspect from which the damage mechanism 
approaches, determine the overlap region, O. For the craft to survive a hit on a shotline 
passing through region O that consists of C overlapping critical components, each of the 
C components must survive. Therefore, the probability of survival of the craft, given the 
overlap region is hit is given by 

Ps!h„ = P s /h,P s /h 2 '"P s lh c = 0 (^ _ Pklh, ) • 

i=l 

The overlap region can be thought of as a separate component, with unique presented 
area, P klh value, and vulnerable area. The presented area, A p , is simply calculated 

based on the geometry of the overlapping components. The value of the probability of a 
kill of the component given a hit on the component is calculated as follows 

p = i -p 

1 klh„ 1 1 s/h 0 • 

The vulnerable area of this region is then given by 
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c. The Redundant and Overlapping Model 

As stated previously, most small craft have some degree of critical 
component redundancy and overlap. When dealing with overlapping redundant critical 
components, the overlap region can again be treated as its own component. The equation 
for the probability that the craft survives, given the overlap region is hit is given by Ball 
as 

M N 

=ip,o-rK>,> 

i =1 j =1 

where there are M nonredundant components and N redundant components. It can be 
seen from this equation that, in order for the craft to survive, all the nonredundant 
components must survive individually and not all of the redundant components can be 
killed. The probability that not all of the redundant components are killed is given by the 

N 

complement of P kth . 

M 

The area outside of the overlap region, where redundant critical 
components no longer overlap, is not used for vulnerable area calculations. The reason 
for this is that if a single shotline passes through this nonoverlapping region, only one of 
a set of redundant critical components is killed. This leaves at least one other critical 
component to provide the essential function of the killed component. 

The Cyclone -class patrol craft has several critical components that fit into 

the redundant and overlapping model. This model, however, only accounts for single 

hits. Single hit vulnerability can easily be lessened with the application of separation, 

which will be discussed at length in a later section. The design of the Cyclone is a good 

example of the use of separation. So good, in fact, that it is difficult to calculate the 

single hit vulnerability of the Cyclone to offer as an example. Most of the critical 

components on the Cyclone are redundant and separated. This can be observed in 

Figures 7, 8 and 9. Once redundant components are separated, it is impossible to kill the 

function that they provide with a single hit. For example, one critical component is the 

main propulsion diesel engine. There are four main engines onboard the Cyclone, 

making it a redundant component, and they overlap in the profile view. The number one 

and number four main propulsion diesel engines (MPDE1 and MPDE4) overlap 

31 



completely and are located in the forward engine room, while the number 2 and number 3 
main propulsion diesel engines (MPDE2 and MPDE3) also overlap completely and are 
located in the aft engine room. If a single hit was located in the overlap region of 
MPDE1 and MPDE4 in the forward engine room, only two of the four engines could 
potentially be killed, leaving MPDE2 and MPDE3 to continue providing propulsion for 
the small craft. Because nearly all of the critical components of the Cyclone are set up in 
this manner, the single hit vulnerability of this craft is zero. The craft cannot be killed 
with a single hit of a nonexplosive penetrator. The following figures clearly show the 
complete overlap and the separation of the main engines. 



MAIN 

MAIN ENGINE 
ENGINE 


Figure 7. Inboard Profile of the Cyclone -Class [After Ref. 7] 


ENGINE ROOMS 



MAIN 

ENGINES 


Figure 8. Second Deck Arrangement of the Cyclone -Class [After Ref. 7] 
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SSDG1 


MPDE3 


MPDE4 



MPDE2 MPDEl 


Figure 9. Interior Arrangement of the Fore and Aft Engine Rooms of the Cyclone -Class 

[After Ref. 7] 

5. Multiple Hit Vulnerability 

Single hit vulnerability measurements are useful for theoretical scenarios; 
however, multiple hit vulnerability measures are used to model true combat situations. In 
Ball’s method, it is assumed that if a craft is hit, it will receive multiple hits. Ball also 
assumes that these hits have a random distribution over the craft, and all hits are produced 
by damage mechanisms that travel along parallel shotlines from the same direction. Ball 
offers the following equation for the probability of the survival of the z'* critical 
component after n random hits on the craft 


r S/H: 


. D< 1) p(2) 

' r slH i r slH i 


■P 


( n) 


s/H, 


11 '■ 

j =i 


where P^/l, is the probability the i th component survives the j th hit on the craft. This is 

the complement of the probability that the i"' component is killed by the j th hit. 
Accordingly, 
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These equations can be used directly in the small craft vulnerability assessment. 
The example of the Cyclone -class patrol craft can be continued here, again with the 
critical component of the number one ship service diesel generator (once more without 
consideration given to its redundancy). For this example, it will be assumed that the 
Cyclone receives 5 hits. The probability the diesel generator survives after 5 hits on the 
Cyclone is given by 


d ( 5) _ i r p (j) 

s ^n SSDGl | s/h ssdg i 

j =i 


where 


p\J) _1 _ p\J) 

s / Hssdgi k! Hsl 


The probability that a component is killed given a random hit on the craft is a 
function of the probability of the component being hit given a random hit on the craft, 
and the probability of the component being killed given a hit on the component. Neither 
of these measures of vulnerability varies with the number of hits on the craft. Because of 
this, the previous equations can be simplified as follows 


na-A'/twa-W'- 


For the Cyclone example 


(l-(0.00234)) 5 =0.9884 


Since probability that the generator survives a single hit was already calculated to be 
0.9977, this clearly shows that the survivability of the diesel generator decreases as the 
number of hits increases. 


In the case of redundant components, these calculations become more complex 
because the vulnerable areas of components and the probability of a ship kill given a 
random hit change with subsequent hits. Ball offers four methods that model the effects 
of multiple hits: (a) the kill tree diagram, (b) the state transition matrix, (c) the simplified 
approach for , and (d) multiple hit vulnerable area. 
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a. Kill Tree Diagram 

Kill tree diagrams can be created for both nonredundant and redundant 
models. A kill tree is relatively self-explanatory for the nonredundant model. Figure 10 
defines the mutually exclusive kill probabilities of each of the nonredundant components 
and the probability that no critical components are killed after the first hit on the craft. 
Note that the summation of these quantities is unity. This diagram accounts for all 
possibilities of the effect of the first hit. The second hit adds more possibilities, as is 
shown in Figure 11. These are nonredundant models so they will not be applied to the 
Cyclone. Figures 12 and 13 define the kill probabilities for the first and second hit, 
respectively, for a redundant craft. “KILL” indicates that the hit or series of hits for that 
“branch” of the tree results in a craft kill. 


This method can be directly applied to the Cyclone -class with the 
construction of a kill tree diagram that encompasses all of the redundant and 
nonredundant critical components in the craft. However, a more simplified approach will 
still prove that the method can be applied to small craft. This type of approach is offered 
in Figure 14. This kill tree diagram uses only the pair of ship’s service diesel engines as 
examples of redundant critical components. The example used the probability of an 
SSDG kill given earlier by 


k/H,, 


(6.6ft 2 ) 
(2820 ft 2 ) 


0.00234 



KILL (Nrc2 Kill) 

KILL 

Figure 10. Kill Tree Diagram: First Hit, Nonredundant Model 


35 



**/*ih, 

(Nrcl Kill) 

KILL 






r S/H 
(No Kills) 



KILL 


KILL 


Figure 11. Kill Tree Diagram: Second Hit, Nonredundant Model 



1 

(N o Kills) 


Figure 12. Kill Tree Diagram: First Hit, Redundant Model 
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Figure 13. Kill Tree Diagram: Second Hit, Redundant Model 


SSDG1 
0.00000053 


SSDG2 

0.0000053 

KILL 



None 

0.9954 


SSDG1 

0.002289 


None 

0.9908 


SSDG2 

0.002289 


0.0000053 

KILL 


0.0000053 0.002289 


Figure 14. Kill Tree Diagram: Second Hit, Cyclone -Class Model 
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b. State Transition Matrix 

The state transition matrix method assumes that a series of random hits on 
a craft can be modeled as a Markov process. This process defines the state of a craft 
based on the possible combinations of critical component kills or survivals. A very 
general example can be used to illustrate how this method might be used for a small craft. 
For this example, it will be assumed that the critical components of the small craft are 
only the two ship’s service diesel generators. The vulnerable area data for these 
components is listed in Table 5. 

A small craft consisting of two SSDGs can exist in four distinct states: 

(a) Only SSDG1 has been killed, denoted by krc\ 

(b) Only SSDG2 has been killed, denoted by krcl 

(c) Both SSDG1 and SSDG2 have been killed, resulting in a craft kill, denoted by 

Krc 

(d) Neither SSDG1 nor SSDG2 have been killed, denoted by nk . 

State (c) is called an absorbing state, because the small craft cannot transition from this 
kill state to any of the other nonkill states, since, in state (c) the craft has been effectively 
killed. 

Ball’s method prescribes that a transition matrix, \T\, a matrix of 
probabilities be constructed. This matrix specifies how the small craft transitions from 
state to state, as a result of a hit. Table 6 illustrates the general fonn of the [T] matrix for 
this example, and Table 7 shows the actual [7] matrix. 

Note that the sum of each of the columns in matrix [7] is one. This 
makes sense, since the probability that any nonkill state will transition to any other state 
after a hit is one and the probability that a kill state will remain a kill state after a hit is 
also one. The [7] matrices presented in this thesis are meant only for the purpose of 
exemplifying the applicability of Ball’s method. They are by no means complete and 
many more critical components would need to be considered for them to be meaningful 
in a vulnerability assessment. 
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Table 5. Data for State Transition Matrix 


Critical Component 

A„ (ft 2 ) 

SSDG1 

6.6 

SSDG2 

6.6 

A P = 2820 ft 2 


Table 6. General State Transition Matrix [7] for Sample Small Craft 


Probability of Transitioning from this State 

To this 


Krc krc 1 krc2 nk 

state 

1 

a; 

krcl + krc2 krc2 krcl krcl + krc2 

0 krcl + ( A p — krcl - krcl) 0 0 

0 0 b~c2 + ( A p — krcl - krcl) 0 

0 0 0 A p — krcl — kr2 

Krc 

krcl 

krc2 

nk 



Table 7. State Transition Matrix [7] for Sample Small Craft 


Probability of Transitioning from this State 

To this state 

Krc krc 1 krc2 nk 


1 

2820 

"2820 6.6 6.6 6.6+ 6.6 

0 6.6+ (2820-6.6-6.6) 0 0 

0 0 6.6+ (2820-6.6-6.6) 0 

0 0 0 2820- 6.6 -6.6_ 

Krc 

krcl 

krc2 

nk 



The feasibility of these matrices proves that the state transition method is 
applicable to small craft. Further manipulation of [7] yields a value for P ^ H , the 
probability of a craft kill given n hits. 
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c. Simplified Method for Pf'f 

Another means of obtaining Pf‘\, is Ball’s simplified method. With this 

technique, the assumption that individual component kills are mutually exclusive for any 
one hit is neglected. Then, if the probability of survival after one hit on the craft is 
known for each critical component, an approximation for the probability that the craft has 
been killed by n hits can be obtained. This approximation can be used for a craft with 
both redundant and nonredundant critical components. The following equation 
approximates the probability of survival 

_ M _ N __ 

Psw =n( i -- p A,K i -ri F A,> 

i =1 j —1 

where there are M nonredundant components and N redundant components, and where 

r k!H i 1 V 1 r klH i J 

and 

p 0,) =}-(}- p y 

r k/Hj 1 ' 1 r klHj ) ■ 

Continuing the simple example that was used for the state transition 
matrix, using a sample small craft with only two redundant critical components (SSDG1 
and SSDG2) and no nonredundant critical components, the following calculations can be 
made for five hits on the craft 

p s % = [i ■- o 5 Ki - a - a - p ktHm y xi - a - p k , HsSDG2 y )i 

= [1][1 -(1 -(1 -0.2) 5 )(1 -(1 -0.2) 5 )] = 0.935 . 

Again, this shows that Ball’s method is applicable to small craft. 

d. Multiple Hit Vulnerable Area 

For craft with redundant critical components, which most small craft are, 
the probability of a kill given a hit and the corresponding vulnerable area change with 
each hit. This is due to the fact that the possibility of the loss of one or more of the 
redundant components increases with each hit. An event-based probability will lead to 
more accurate vulnerable area calculations, because the probability of a craft kill on the 
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n"' hit depends on whether or not it has survived the first n — 1 hits. Ball expresses this 
with the following equation 


p(«) _ p(rt-l) (\ _ p( n ) \ 
r S/H r S/H V 1 r K/H) 


which can be rearranged to give 


pin) _ pin- 1 ) 

pin ) 1 K/H 1 K/H 

K/H 1 _ p(" _1 ) 

1 r K/H 


The value for P^ H can then be used to calculate a more accurate vulnerable area for a 
redundant craft using 

J(") _ A p (") 

^P 1 K/H • 


This method would obviously be applicable for small craft, since it is simply a 
modification of previously discussed techniques. 

B. INTERNALLY DETONATING WARHEADS 

Ball’s method of computing vulnerability measures continues with internally 
detonating warheads. Most guided missiles and large projectiles are equipped with 
contact fuzes. Such a fuze will detonate the warhead either immediately or shortly after 
impacting a craft. Along with detonation come issues not addressed in the previous 
discussion of nonexplosive penetrators and fragments, those of blast and fragment spray. 
When a warhead detonates inside a craft, it sends a spray of fragments out radially from 
the warhead burst point. This means that the fundamental assumption made in the 
previous nonexplosive penetrator vulnerability assessment, that of parallel shotlines for 
all fragments, will not hold true for internally detonating warheads. The vulnerability 
measures that must be calculated for internally detonating warheads are the probability of 
a craft kill given a random hit and the probability of a kill of any of the components that 
lie on any of the radial fragment shotlines. Ball proposes two methods for calculating 
these probabilities: (1) the expanded area approach and (2) the point burst approach. 

1. Expanded Area Approach 

The expanded area approach is a simple method using the same basic principles 
that have already been discussed. Intuition says that the probability that a fragment hits a 
given critical component should increase now that the assumption of parallel shotlines is 
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gone. One way to model this increase in the likelihood of a hit is by expanding the 
presented area of the given critical component. This allows for the computation of P k/H 

in the same manner as was used for the nonexplosive penetrator, including the treatment 
of overlapping areas. For example, in aircraft one critical component is the pilot. The 
presented area of the pilot when faced with a nonexplosive penetrator is the actual 
physical size of the pilot. For an internally detonating warhead, the expanded presented 
area of the pilot is the entire presented area of the cockpit, because if the warhead burst 
point is located anywhere within the cockpit, the pilot will most likely be hit. 

The same method can be applied to small craft. For the example of the Cyclone- 
class patrol craft, the number one ship service diesel generator is one critical component. 
It is located in the forward engine room. If the warhead burst location is anywhere within 
the forward engine room, there is a good chance that SSDG1 will be hit. Because of this, 
the expanded presented area of SSDG1 can be the entire presented area of the forward 
engine room. Furthennore, the number one and number four main propulsion diesel 
engines are also located in the forward engine room, meaning that they will have the 
same expanded presented areas. These three areas overlap completely, which can be 
treated in the same manner as the overlap case for nonexplosive penetrators. 

The compartmentalization that is inherent to naval ships aids in the process of 
defining expanded presented areas for critical components. If it is assumed that fragment 
spray cannot penetrate the watertight bulkheads on a ship, then each watertight 
compartment can potentially be the expanded presented area of one or more critical 
components within each compartment. This is not to say that the presented area of 
compartments is always the most appropriate value for the expanded presented area of a 
critical component within the compartment. 

The idea of considering the entire space rather than just the critical component is 
very much like the ship design convention of identifying the “vital spaces” on a surface 
ship. Vital spaces are those compartments of which continued operation is essential for 
maintaining ship control, propulsion, communications, seaworthiness or fighting 
capability. The vital spaces on the Cyclone are: Pilot House, Electronics Room, CIC, 
Crypto Room, Forward Magazine, Engine Operating Station, Aft Magazine, Auxiliary 

Machine Room No. 1, Auxiliary Machine Room No. 2, Forward Engine Room, Aft 
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Engine Room, and Steering Compartment. [Ref 8] If a warhead burst is located within 
any of these vital spaces, there is a chance that at least one fragment will hit at least one 
component that is critical on some level. The distinction that should be made is that vital 
spaces are essential for the prevention of a kill at any level—system, mission, mobility, 
and total. Therefore, these spaces contain critical components that are relatively critical 
based on which kill level is being assessed. Nonetheless, these vital spaces can often be 
useful when defining expanded presented areas for critical components. 

For the Cyclone- class, using the main engines as critical components, the expanded areas 
are shown in Figure 15. Some sample P k/H values are given in Table 8. 



| Main Engine Presented Area 
| Main Engine Expanded Presented Area 

MAIN 

ENGINE 


MAIN 

ENGINE 


Figure 15. Expanded Area Approach for Cyclone-Class [From Ref. 7] 

Table 8. Sample Vulnerability Measures for the Cyclone -Class against Internally 

Detonating Warheads 


Critical Component 

A Pi 

A P e, ( ft2 ) 

p 

1 k/h, 

A, 

(ft 2 ) 

P 

1 k! H ( 

Main Propulsion Engine 

77.0 

180 

0.3 

54 

0.0194 

Forward Shaft 

20.7 

30 

0.45 

13.5 

0.0048 

Aft Shaft 

11.1 

20 

0.45 

9 

0.0032 

Diesel Generator 

33.0 

100 

0.4 

40 

0.0142 
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2. Point Burst Approach 

The second approach that Ball offers for computing the vulnerability measures of 
a craft against an internally detonating warhead is the point burst approach. For this 
method, a grid is superimposed over the presented area of the craft. Each cell of the grid 
contains a randomly located burst point. The probability of a craft kill is calculated for 
each burst location. This method allows for more than one critical component to be 
killed at once. The probability of a craft kill is dependent on the relative location of 
critical components and shielding provided by critical and non-critical components. This 
method helps to create a point burst field that has a random nature, but also offers 
complete coverage of the craft. With this method, the grid is only used as a means of 
placing the point bursts; it does not confine the actual effects of the burst. When the 
probability of a ship kill is calculated for a given burst in a given grid cell, damage to 
components both inside and outside the grid cell are considered. This is much like the 
method that is currently used for ship survivability in the Ship Vulnerability Model 
(SVM), which implies that the method should be applicable to small surface craft. 

The probability of a craft kill is calculated in much the same manner for this 
method as in the methods previously discussed. First, the probability of a craft kill given 
a hit, P KIH , is determined for every burst point. This value is established by examining 

each cell, determining which components (internal or external of the cell) would likely be 
killed if there were a hit in that cell at the location of the burst point. The probability that 
those components are killed given a hit at the burst point can be calculated through 
nonexplosive penetrator/fragment methods previously discussed. From all of this, the 
probability of a craft kill given a hit at the specified burst point can be calculated. The 
product of this value and the probability of a random shot hitting the burst point area, P H , 

gives the probability of a craft kill given a random hit, P KIH . The probability of a random 
shot hitting the burst point area is given by Ball as 

P H =^~, b = \,2...B 

Hb A/ 
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where B is the total number of burst points to be considered and A b is the presented area 
of the cell containing the given burst point. Ball offers the following equations to 
calculate the P K/H function and the vulnerable area of the craft A v 

P KIH =^l P H b P K/H b ~~ ^Ll A b P K/H b = ~7~ X A„ 

b= 1 A-p b= 1 sip 6=1 

A = 'Zj A b P K/H b 

6=1 6=1 

where A„ is the vulnerable area of the b th cell. 

In the point burst method, it is important to define the potential expanse of 
damage for the given warhead. This value aids in the detennination of what components 
will be affected by a given burst. The size of the burst and the amount of damage that it 
can cause depend on several factors. The most crucial of these is the weight of the 
explosive. Figure 16 shows the relationship between the blast damage volume and the 
weight of the explosive for TNT. With the help of figures like this one, vulnerability of a 
small craft to internally detonating warheads can be calculated using the point burst 
approach. [Ref. 4] 

For the example of the Cyclone-Class, the point burst approach can be used 
directly. Figure 17 illustrates the point burst grid superimposed over the presented area 
of the Cyclone. Each cell contains one randomly located burst point. 

C. EXTERNALLY DETONATING WARHEADS 

BalFs method of computing vulnerability measures continues with externally 
detonating warheads. Most large caliber projectiles and several air-to-surface missiles 
employ externally detonating warheads. Furthermore, non-contact fuzed mines detonate 
at some stand-off distance exterior to the craft they pursue. When a craft encounters an 
externally detonating warhead, it faces potential damage from the blast or shock as well 
as from the fragments generated at detonation. BalFs method does not address shock, as 
it is strictly a phenomenon of underwater explosions. The vulnerability of a craft to each 
of these three damage mechanisms can be examined separately. 
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Figure 16. Increase of Damage Volume with Weight of Explosive [From Ref. 9] 



Figure 17. Burst Point Approach for the Cyclone -Class 

1. Blast 

In order to determine the vulnerability of the craft to blast, the damage criteria for 
blast pressure must be calculated for each critical component. Each critical component 
has a blast pressure threshold above which it will be killed. This is strictly a function of 
the component and its make-up. The blast pressure created by an externally detonating 
warhead is a function of the type of explosive, the weight of the charge, and the stand-off 
distance at the time of detonation. With this data, the minimum stand-off distance of a 
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given charge can be calculated for any of the kill levels. Ball indicates that this 
information is generally illustrated in one of two ways: a plot of charge weight versus 
stand-off distance for a constant kill level; or external blast kill isocharge contours about 
a craft for a constant kill level. Either or these can be constructed for a small craft. 
Typically, a spectrum of common combinations of charge types and weights are 
considered for either of these presentations. 

2. Fragments and Penetrators 

When an externally detonating warhead detonates, the fragments or penetrators 
that result from the detonation eject in a relatively unifonn manner. Ball assumes that 
they eject completely uniformly around the missile axis, and radiate outward in a 
divergent spherical-like spray pattern. The damage to the craft that is caused by these 
penetrators is dependent upon the number and location of fragment or penetrator impacts 
on the craft, the average mass of the fragment or penetrator, and the fragment or 
penetrator impact velocity. The vulnerability measure that is typically computed for 
fragments or penetrators from an externally detonating warhead is P K/D , the probability 
of a craft kill due to the burst of a specific type of explosive, for a specific set of 
encounter conditions. The encounter conditions include the altitude and relative position 
of the warhead, the velocities of the craft and the warhead at the time of detonation, and 
the fragment or penetrator static velocities and static spray angles. P K/D depends on the 

number of fragments or penetrators that actually impact the craft, and the craft’s 
vulnerability to those hits. 

The method for calculating P K/D corresponds to the method Ball offers to 

calculate multiple hit vulnerability with respect to nonexplosive penetrators or fragments. 
For externally detonating explosives, however, it is possible to estimate the number of 
hits on the craft based on the encounter conditions. Figure 18 illustrates an assumed 
encounter between an externally detonating missile and the Cyclone -class patrol craft. 
The angles <j> x and (j) 2 represent the leading and trailing fragment dynamic trajectories, 
respectively, and R is the distance from the point of detonation to the craft. 
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Figure 18. Assumed Encounter between Externally Detonating Warhead and the Cyclone- 

Class Patrol Craft [After Ref. 2] 

In order to estimate the number of hits on the craft, Ball assumes that the entire 
presented area is hit by a spray of fragments or penetrators. These fragments or 
penetrators are assumed to travel along parallel trajectories and impact the craft 
randomly. Ball offers the following equation for the number of hits, n , on the presented 
area of the craft 

n = pA p 

where p is the fragment spray density (average number of fragments per unit area of 
fragment spray). 

The fragment spray density can be solved for using a more realistic set of 
assumptions about the spray. To do this, Ball assumes that the fragments have uniform 
velocity, and are uniformly spread over a spherical segment between ^ and <j > 2 , with 
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respect to a stationary target. For a warhead with N total fragments, at a distance s 
from the detonation point, the fragment spray density is given by the following equation 

N 

P = -j-• 

2;b“(cos^ 1 — cos $2 ) 


Ball defines angles </) x and <p 2 with the following equation 


</> i = arctan 


V m sin 6 + V f sin(6^ + cx t ) 
V m cos 0 + V f cos(0 + (Z.) — V t 


■0 


i = 1,2 


where V m is the missile speed, V f is the average fragment or penetrator speed with 
respect to a stationary warhead, V t is the target speed, 6 is the missile elevation angle, 
and a l is the fragment or penetrator spray angle from the axis of a static warhead 
detonation for either the leading or trailing fragment/penetrator. 

Once the number of hits is determined, the problem becomes identical to one of 
multiple hit vulnerability against nonexplosive penetrators or fragments, which has 
already been covered, and shown to work for small craft. The probability that a craft is 
killed by n random hits, P^ H , is equivalent to P K/D . Because of this, the simplified 

method for P^% can be used to assess the vulnerability of the craft. This is expanded 
upon in the following derivations from Ball: 

7=1 


where P^/ H is the probability of a craft kill on the j th random hit. For small P^ j / H 


and 


na-p^exp 

7=1 'v 


n 

y p u) 

/ , K/H 

7=1 


therefore, 


y p u) 

/ , K/H 


7=1 


n A (j) 

A 

7=1 A P 
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K/D 


( 

= 1 - exp 

v 


n J= i 




J 


Since A < v ' ) is assumed to remain constant for all hits, 


p k/d = l-exp(-p^ K ). 

For the example of the Cyclone-class patrol craft, facing given encounter 
conditions, these fonnulae can be directly applied to compute the vulnerability to the 
spray from an externally detonating warhead. Certain infonnation about the warhead and 
the craft must be known or assumed in order to perfonn the calculations. An example 
calculation of P K/D for the Cyclone-class is shown in conjunction with Table 9. This 

example illustrates one of the many examples in which Ball’s specific techniques for the 
assessment of aircraft vulnerability can be directly applied to the small craft. 

The calculation of the fragmentation dynamic spray angles is completed as 

follows 


= arctan 


(1500) sin(30°) + (7000) sin(30° + 50°) 
(1500)cos(30°) + (7000)cos(30° + 50°) - (42.2) 


-(30°) = 42.1° 


(j) 2 = arctan 


(1500)sin(30°) + (7000)sin(30° +120°) 
(1500)cos(30°) + (7000) cos(30° +120°) - (42.2) 


-(30°) = 108.5° 


Fragment spray density is then calculated by 


P = 


_ ( 1000 ) _ 

2;t(80) 2 [cos(42.1° ) - cos(l 08.5°)] 


= 0.0235 fragments/ft 2 


And finally, the probability of a ship kill can be calculated 

P KID = l-exp(-0.0235x50) = 0.691. 
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Table 9. Given Data for Example Computation of P K/D for the Cyclone -Class 

[After Ref 2] 




Leading Spray Angle 

a\ =50° 

"d 

<D 

43 

cn 

<D 
+-* 

Trailing Spray Angle 

a 2 =120° 

£ 

c3 

GO 

s 

cd 

34 

Number of Fragments or 

Penetrators 

V = 1000 



Fragment Velocity 

V f =1000 ft Is 

cn 

<D 


Missile Speed 

V m =1500. ft Is 

-t—» 

<D 

5 

cd 

Vh 

34 

t-H 

<D 

» 

£ 


Missile Angle 

6 = 30° 


Detonation Distance 

R = 80 ft 

O 

o 

c 


Cyclone Speed 

V t = 25 knots 

W 



= 42.2. ft Is 


C to 

s—* 

Cyclone Presented Length 

L, = 170 ft 

"2 

$ 

5 

Sample Aspect Vulnerable 

A v = 50 ft 2 


Ph 

Area for the Given Threat 



3. Shock 

Shock is a phenomenon that occurs due to an underwater explosion. Obviously, 
Ball does not cover the effects of shock on an aircraft in his vulnerability assessment. 
For this reason, the vulnerability of the Cyclone -class to shock will be left unexamined, 
as the focus of this thesis is the applicability of aircraft vulnerability measures to small 
surface craft. This is one particular instance where the aircraft vulnerability methods 
cannot be directly applied to small craft. 


51 




D. VULNERABILITY TO LASERS 

Vulnerability to lasers is treated in the same manner as vulnerability to the single 
nonexplosive penetrator. 

E. VULNERABILITY TO UNCONVENTIONAL WEAPONS 

Ball does not address the vulnerability of an aircraft to unconventional weapons. 
In today’s environment, however, unconventional weapons are being seen as an 
increasing threat to both surface craft and aircraft alike. The U.S. Coast Guard is 
currently using the Cyclone -class for homeland security purposes. The potential threats 
that come with this mission include a very real threat from unconventional weapons. 
Because of this, a thorough vulnerability assessment of the Cyclone -class would include 
its vulnerability to unconventional weapons. This is another instance where the aircraft 
vulnerability methods proposed by Ball are not sufficient for small craft. 
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IV. VULNERABILITY REDUCTION 


A. VULNERABILITY REDUCTION CONCEPTS 

Vulnerability reduction concepts are means of controlling or reducing the amount 
of damage to a craft caused by damage mechanisms. Ball offers several specific 
techniques to reduce craft vulnerability. These techniques include: 

• Component Redundancy with Separation 

• Component Location 

• Passive Damage Suppression 

• Active Damage Suppression 

• Component Shielding 

• Component Elimination 

Most of these concepts are self-explanatory, however some need further explanation. 
Passive damage suppression, for example, is any design technique that, without damage¬ 
sensing capabilities, reduces or contains the effects of damage after the impingement of a 
damage mechanism. Ball offers the following passive damage suppression techniques as 
viable vulnerability reduction concepts: 

• Damage Tolerance 

• Ballistic Resistance 

• Delayed Failure 

• Leakage Suppression 

• Fire and Explosion Suppression 

Active damage suppression is any technique that, with the help of a sensor or other 
detection device, reduces or contains the effects of damage after impingement of a 
damage mechanism. 

B. CYCLONE- CLASS DESIGN FOR REDUCED VULNERABILITY 

The major systems of small craft in general, and the Cyclone- class specifically, 
are the propulsion system, electric system, auxiliary system, structural system, and crew 
system. Using Ball’s vulnerability reduction concepts, a brief description of vulnerability 
reduction to each of these systems is presented below. The discussion includes general 
principles that can be applied to all small craft vulnerability reduction processes, as well 
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as descriptions of how some of these principles might be applied specifically to the 
Cyclone -class patrol craft (or how they could have been applied during her design phase). 

1. Propulsion System 

The propulsion system is considered to include the main propulsion engines, the 
fuel oil subsystem, the lubrication subsystem, the controls, and the power train and 
propeller subsystem. 

a. Kill Modes 

Possible damage-caused failure modes of the propulsion system are engine 
failure, fuel supply depletion, in-tank fire and explosion of fuel oil, lubrication starvation, 
in-ta nk fire and explosion of lubrication oil, propulsion controls failure, and power train 
or propeller failure. [Ref. 4] 

b. Design Guidance and Vulnerability Reduction Techniques 

(1) Prevention of Engine Failure. The propulsion system of the 
Cyclone -class has been designed in accordance with many of Ball’s vulnerability 
reduction concepts. There is redundancy among the most critical components. There are 
four of each of the main propulsion engine, shaft, gearbox, and propeller. In order for 
redundancy to be effective, there must be separation such that one hit will not directly or 
indirectly kill more than one redundant component. Due to the overall size of the 
Cyclone, there is limited space for separation. By locating the two engine rooms adjacent 
to one another there is little chance for significant separation of the critical propulsion 
components. In the aft engine room there is even less separation than in the forward 
engine room since main engines number two and three are on inboard shafts, resulting in 
a lateral separation of only a narrow passageway between them. The design of the 
Cyclone -class would have been made less vulnerable if the two engine rooms had not 
been located adjacent to one another. This, however, was most likely not feasible due to 
stability restrictions having to do with the location of the center of gravity of the ship. 
With adjacent engine rooms, the design could have been made slightly less vulnerable by 
locating engines one and four as far forward as possible in the forward engine room while 
locating engines two and three as far aft as possible in the aft engine room. This would 
have decreased the vulnerability slightly as it would have provided a few more feet of 
separation. 
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Another method that could be used to prevent engine failure on the 
Cyclone is to insert ballistic and/or fire resistant material, or a shield, between laterally 
adjacent engines. This would create a material, rather than geographic separation between 
the redundant components because it would decrease the likelihood that a single hit could 
kill more than one of the components. This is a good technique for decreasing 
vulnerability when there is not a lot of room for critical component separation. 

(2) Prevention of Fuel Supply Depletion. There are three fuel 
oil tanks onboard the Cyclone- class. The forward fuel tanks are located on the port and 
starboard side of the fourth watertight subdivision, below the galley/mess deck. The after 
fuel tank is located in the seventh watertight compartment, below the after crew berthing. 
This tank is surrounded by a void on three sides. The prevention or minimization of fuel 
leakage is essential for the prevention of fuel supply depletion. Because, however, there 
is redundancy and effective separation among the fuel tanks, fuel supply depletion is not 
a significant threat for the Cyclone- class. [Ref. 7] 

(3) Prevention of In-Tank Fire and Explosion of Fuel Oil or 
Lubrication Oil. Prevention of fire and explosion can be accomplished using either 
passive or active techniques. The methods in Table 10 are techniques suggested by Ball 
for fire and explosion prevention, all of which could be directly applied to small craft in 
general. 


Table 10. Some Techniques for Preventing Fires and Explosions [From Ref. 2] 


Passive Techniques 

Active Techniques 

Flexible, reticulated polyurethane foam 

Ignition source/flame front detection and 
combustion suppression 

Rigid, closed-cell ballistic foam 

Flydraulic ram detection and combustion 
suppression 

Fibrous filler 

Fire detection and fire extinguishing 

Expanded aluminum batts 


Nitrogen inerting (liquid, gaseous, or onboard 
generation) 


FIALON inerting 


Antimisting fuel 


Powder packs 


Purge mats 


Void space venting with air 


Fire walls 
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The Cyclone is equipped with damage control equipment, which can aid in recovering 
from a fire. As the focus of this thesis is on vulnerability reduction rather than 
recoverability, small craft damage control systems will not be addressed. 

(4) Prevention of Lubrication Starvation. Ball maintains that 
one of the most important techniques for reduction of propulsion system vulnerability is a 
fail-safe or damage-tolerant lubrication system. Fail-safe designs contain components 
that will revert to marginally operable conditions for a specified or indefinite period of 
time after the impingement of the damage mechanism. Damage tolerance refers to the 
ability of a system to accept a degree of mechanical damage without the impairment of its 
functional capability. Oil sump, lines, and tanks are extremely susceptible to penetration 
by even the smallest penetrator if their vulnerability has not been specifically addressed. 
Ball proposes the use of self-sealing lines, shielding, and armor as means of protecting 
the lubrication system. Furthermore, bypass lines that isolate damage or leaking lines can 
further decrease the vulnerability of a craft to lubrication loss. These methods are just as 
applicable to small craft as they are to aircraft. 

(5) Prevention of Propulsion Controls Failure. In most small 
craft, the propulsion system is controlled with an electro-mechanical system that uses 
electrical signals from the command levers to provide input to the electronic governor. 
The propulsion control system of the Cyclone -class is usually controlled from one of the 
following locations: the pilot house; the port and starboard bridge wings; the engineering 
operating station (EOS); or in an emergency, at local control panels within the engine 
room [Ref. 7]. The redundancy and effective separation among these propulsion controls 
stations indicates that the propulsion controls system adequately designed with respect to 
vulnerability. 

(6) Prevention of Power Train and Propeller Failure. The 
power train and propeller subsystem consists of the shafts, gearboxes, and propellers that 
transmit power from the engines to the propellers of a small craft [Ref. 8]. The most 
likely kill modes of the power train and blade system are loss of lubrication and 
mechanical or structural failure. In general, power train and propeller failure can be 
prevented through the employment of redundant and separated load paths, as well as 
damage-tolerant materials. The damage-tolerance techniques for the prevention of 
lubrication starvation mentioned above will also decrease the likelihood of shaft, 
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gearbox, or propeller failure due to lubrication starvation. In general, Ball recommends 
the use of solid lubricants, high-temperature grease, and oil additives as less vulnerable 
lubrication techniques. These specific techniques can be directly applied to small craft. 
Mechanical and structural failure can be prevented with further use of damage tolerance. 
Shafts should be designed to provide safe operation after a certain degree of mechanical 
or structural damage. There are four gearboxes, shafts, and propellers, which makes each 
of these components redundant, but none possess a great deal of separation. Because 
this, shielding or ballistic resistance could be employed in order to decrease the 
likelihood of multiple kills given a single kill. Any portion of these components that 
cannot tolerate penetration by a damage mechanism should be shielded with noncritical 
components or ballistic-resistant armor. Portions of the drive train that are especially 
susceptible, such as shaft couplings and intennediate shaft supports, should also be either 
shielded or armored. 

2. Electric System 

The electronic system is considered to include the ship service generators, the AC 
lighting and power subsystem, the DC propulsion and power subsystems, the distribution 
system, and all electronic equipment. [Ref. 8] 

a. Kill Modes 

The possible damage-caused failure modes of the electrical system are 
mechanical or electronic failure of the electric system components. 

b. Design Guidance and Vulnerability Reduction Techniques 

(1) Prevention of Mechanical Failure of Electric System 
Components. The electric system onboard a small craft like the Cyclone is made up of 
components that are extremely susceptible to penetration by even the smallest penetrator 
if their vulnerability is not specifically addressed. Shielding and armor are typically the 
most feasible means of protecting these components. Here again, separated redundant 
components are useful for decreasing the vulnerability of the electric system. The 
Cyclone is equipped with two independent ship service diesel generators (SSDG). The 
generators are of adequate size to solely handle the entire load of the ship. Furthermore, 
they can be configured so that the off-line generator automatically starts and picks up the 
load in the event the online generator fails. SSG1 is located on the centerline in the 
forward part of the forward engine room. SSG2 is located in the after port section of the 
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aft engine room. This provides them with a decent amount of separation. Although the 
Cyclone does not have an emergency generator set, the class is equipped with a 24 volt 
direct current system that provides power to many of the critical electronic components 
including the main propulsion control system. Furthermore, in the event of a total loss of 
ship’s service power, the engine starting battery ha nk s can be employed for extremely 
critical functions. These emergency systems add an additional level of redundancy to the 
overall system, making it less vulnerable. [Ref. 7] 

(2) Prevention of Electronic Failure of Electric System 
Components. Electronic failure can occur as the result of phenomena such as an 
electromagnetic pulse from a nuclear explosion. Anything that produces extremely high 
voltages can destroy electronic circuits and potentially render electronic equipment 
onboard ineffective. For protection against high voltage, electric equipment should be 
enclosed within a metal container, or grounded with metallic meshes incorporated into 
non-metallic structures. [Ref 9] These methods are just as applicable for aircraft as they 
are for small craft. 

3. Auxiliary System 

The auxiliary system of a small craft includes all the auxiliary subsystems that are 
generally essential for daily life and mission performance. In general, killing an auxiliary 
subsystem will cause only a system kill or a mission area kill, as defined in Chapter II. 
Because of this, the vulnerability reduction of the auxiliary system will not be discussed 
at length. 

a. Kill Modes 

Any of the auxiliary subsystems are susceptible to mechanical or structural 

failure. 

b. Design Guidance and Vulnerability Reduction Techniques 

The likelihood of mechanical or structural failure of the auxiliary 
subsystems can be decreased with the use of most of the methods that have already been 
discussed. Redundancy and separation of components that provide essential functions for 
the particular auxiliary system is crucial. 

4. Structural System 

The structural system consists of all the components of the craft that transmit and 
react to the inertial, hydrodynamic, and aerodynamic loads. The structure of a small craft 
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consists of the hull, the watertight bulkheads, the keel, the girders, the stringers, the deck, 
and the deckhouse. 

a. Kill Modes 

The possible damage-caused failure modes of the structural system are 
structural removal, pressure overload, thermal weakening, and penetration of any of the 
components of the system. 

b. Design Guidance and Vulnerability Reduction Techniques 

Significant vulnerability reduction for the structural system is difficult to 

accomplish after the design phase of the craft is complete. However, during the design 
process, it is important incorporate multiple load paths and crack stoppers into the 
system. These are means by which catastrophic structural failure can be prevented. 

Structural vulnerability depends greatly on the materials with which the 
components are constructed. The Cyclone is an example of standard material selection 
for a U.S. Navy ship. With an aluminum deckhouse and a steel hull, the Cyclone has 
good structural survivability. However, not all small craft have steel hulls. Aluminum 
and lightweight composites are common choices for the hulls of small craft. In general, 
aluminum and composites, when used for components in the structural system, are more 
vulnerable to structural failure than steel counterparts. Structural vulnerability is just one 
aspect to bear in mind during the design phase, and material selection will ultimately be 
made based on many considerations. 

6. Crew System 

The crew system of a small craft consists of all the personnel onboard. For the Cyclone 
this means 30 crew and 9 SEALS or 9 U.S. Coast Guard personnel for a total 
complement of 39. 

a. Kill Modes 

The crew of a small craft can be affected directly or indirectly by the 
combat damage to a small craft. Directly, the crew can actually be hit by a damage 
mechanism. Indirectly, the crew can experience smoke, fire, flooding, or other secondary 
effects. 

b. Design Guidance and Vulnerability Reduction Techniques 

Again, many of the same methods for vulnerability reduction can be used 

for this system. Crew compartments should be redundant and separated. The Cyclone is 
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a good example of this, having the forward crew quarters located in the third watertight 
subdivision and the aft crew quarters located in the seventh watertight subdivision. 

7. Other Systems 

All other systems onboard a small craft can be treated in the same general manner 
as those listed above. The six vulnerability reduction principles of component 
redundancy with separation, component location, passive damage suppression, active 
damage suppression, component shielding, and component elimination can be applied to 
any system or subsystem. 
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V. CONCLUSION 


The established aircraft vulnerability assessment and reduction techniques laid out 
by Robert E. Ball in The Fundamentals of Aircraft Combat Survivability Analysis and 
Design can be directly applied to small surface craft. Due to the similar natures of 
aircraft and small craft, Ball’s methods are very applicable to small craft, and his theory, 
as well as his specific techniques, can be directly applied to them. The successful 
application of his methods and theory to the Cyclone- class patrol craft proves this. 

Certainly there are areas of surface craft survivability theory not covered by Ball 
that should be addressed for a complete vulnerability assessment of a small craft. 
However, Ball’s methods for aircraft are well established and can be used to provide 
useful information regarding the vulnerability of a small craft. For a complete 
vulnerability assessment, however, shock, flooding, and other such surface ship 
phenomena should be addressed. 
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